CVSS 4.0
2.0 lowCVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:NCVE-2026-32067
Low (2.0) in openclaw openclaw. EPSS 0.2% chance of exploitation in the next 30 days. Fixed in openclaw 2026.2.26.
OpenClaw versions prior to 2026.2.26 contain an authorization bypass vulnerability in the pairing-store access control for direct message pairing policy that allows attackers to reuse pairing approvals across multiple accounts. An attacker approved as a sender in one account can be automatically accepted in another account in multi-account deployments without explicit approval, bypassing authorization boundaries.
Severity
CVSS 3.1
8.1 highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N- EPSS
- 0.2% chance of exploitation in the next 30 days; higher than 5% of CVEs (scores of 2026-10-31)
- CWE
- CWE-863
- Published
- Modified
- Record from
- the NVD, synced
Affected
- openclaw:openclaw
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-vjp8-wprm-2jw9 | npm | openclaw | <2026.2.26 | 2026.2.26 |
References
- https://github.com/openclaw/openclaw/commit/a0c5e28f3bf0cc0cd9311f9e9ec2ca0352550dcf
- https://github.com/openclaw/openclaw/commit/bce643a0bd145d3e9cb55400af33bd1b85baeb02
- https://github.com/openclaw/openclaw/security/advisories/GHSA-vjp8-wprm-2jw9
- https://www.vulncheck.com/advisories/openclaw-cross-account-authorization-bypass-in-dm-pairing-store